Jherrod ThomasThe Lion of Functional Safety™

August 31, 2026 · 16 min read

ISO/SAE 21434 §15 / §8FMVSS 121 S5.1.6 / FMVSS 136CVE-2026-67560 / SAE J2497

When the Noise and the Attacker Sent the Same Bytes: The Bendix EC80 Brake ECU Advisory (ICSA-26-237-05) Through an ISO/SAE 21434 and FMVSS 121 Lens

In late 2024 Bendix recalled roughly 450,000 heavy-truck brake controllers because electrical noise on the trailer powerline could crash them. It was filed as a safety recall, remedied with a firmware update, and closed. Twenty months later a researcher diffed the before and after images and found the update had deleted dozens of functions - and inside those deleted functions were a stack overflow good for remote code execution, an out-of-bounds write, and a hard-coded password that turns off traction control. Same defect. Same patch. Two entirely different sets of consequences, and only one of them got written down.

I have spent a lot of this blog arguing that safety and security analyses keep missing each other at the same seam. This one is the cleanest example I have found, because the two disciplines were looking at literally the same bytes. A malformed message length arriving on a 25-year-old powerline bus does not care whether a diesel alternator produced it or a software-defined radio did. The functional safety team called it noise, rated it, fixed it, and shipped. Nobody asked the second question.

The public record

The recall, 2024. Bendix Commercial Vehicle Systems filed equipment recall 24E086 covering the EC80 brake ECU, the controller that handles anti-lock braking, automatic traction control and electronic stability on air-braked Class 8 tractors. Bendix's own chronology document describes the defect as incorrect signal processing that shows up under "high electrical noise and low Power Line Carrier (PLC) signal strength," and notes that "trucks towing multiple trailers (e.g. double and triple trailers) were more likely to exhibit the combination of high levels of electrical noise and low PLC signal strength." The chronology states the defect "may affect the performance of the electronic stability control (ESC) and/or antilock braking system (ABS) on the truck tractor and/or the towed vehicle."

Three OEMs that integrate the EC80 filed their own campaigns behind it. Paccar (24V915) describes "incorrect processing of PLC messages" and "memory overwrite effects," and says the ECU can go offline. International (24V818) omits the cause entirely. Volvo attributes it to "inadequate systems validation." Three defect information reports, one firmware image, three different stories about why. In 2025 Bendix expanded the action to aftermarket units under 25E073, 25E077 and 25E078. SecurityWeek puts the combined 2024 OEM scope at roughly 450,000 units.

The remedy was a firmware reflash delivered by a standalone .NET utility, ID 9363, used identically across all three OEMs.

The bus. The signal being mis-processed is SAE J2497, better known as PLC4TRUCKS: a powerline carrier link that superimposes data onto the trailer's own power conductor. It has been fielded since 2001 and, as SecurityWeek puts it, has served as the only industry-standard way to satisfy the federal requirement that a tractor display a trailer ABS malfunction indicator in the cab. Trailers last 15 to 30 years, so the installed base is enormous and slow-moving. In 2022, NMFTA's Ben Gardiner, working with NMFTA carrier members and Assured Information Security researchers Chris Poore, Dan Salloum and Eric Thayer, disclosed CVE-2022-26131 (CVSS v3 9.3, CISA advisory ICSA-22-063-01): J2497 receivers are susceptible to remotely RF-induced signals. In plain terms, the trailer power line is an antenna, and the bus is wirelessly writable from outside the vehicle.

At the time, NMFTA's own published assessment was that safety impacts via that vulnerability were "highly unlikely," and they say other industry experts agreed. The 2024 recall retired that assumption. If random noise on J2497 is sufficient to crash a brake ECU, then chosen noise certainly is.

The reverse engineering, August 2026. At Black Hat USA 2026, DEF CON 34 and VehicleSec '26, Gardiner presented the result of pulling pre- and post-update firmware off three EC80 units, one from each affected OEM, and diffing them. The update deleted dozens of functions. Inside the deleted code he identified buffer-handling flaws that could crash the ECU and enable remote code execution, a hard-coded password that could disable traction control, and a further flaw offering a theoretical path to both crash and code execution. NMFTA published a 179-page technical whitepaper alongside the talk.

The road-test results are the part that should hold a safety engineer's attention. On a closed track, driving at roughly 5 mph and roughly 9 mph, NMFTA used a software-defined radio to inject signals through the truck's diagnostic port. Once the crash triggered, CAN bus traffic stopped entirely. Recovery always required disconnecting the battery, and in one case a dealer tool. The denial-of-service state consistently caused loss of speedometer, steering assist, and shifting, as well as ABS pulsing.

The advisory, August 25, 2026. CISA published ICSA-26-237-05, Transportation Systems sector, deployed principally in the United States and Canada. Three CVEs, all reserved August 10 and published August 27, all assigned by ICS-CERT as CNA, all credited to Ben Gardiner of NMFTA:

| CVE | CWE | CVSS v3.1 | Vector | CVSS v4.0 | Effect | |---|---|---|---|---|---| | CVE-2026-67560 | CWE-121 stack-based buffer overflow | 7.5 | AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H | 7.7 | Crash the ECU; crafted payload gives remote code execution or arbitrary CAN injection; loss of ABS, steering assist, speedometer, shifting | | CVE-2026-68967 | CWE-787 out-of-bounds write | 6.5 | AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N | 7.1 | Arbitrary write primitive; crash the ECU | | CVE-2026-71396 | CWE-798 hard-coded credentials | 5.4 | AV:A/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L | 5.3 | Disable automatic traction control |

Affected part families and their fixes: EC80ESP+ builds at Z228999 (J1708, 6S/6M, PLC, 2nd CAN, Integrated TPMS variants) move to Z300822; EC80ESP at Z266494 (6S/6M, PLC, 2nd CAN, CAN Gateway) moves to Z302578; EC80ESP at Z286098 (4S/4M, PLC) moves to Z302579.

Two more facts from the coverage that matter more than the scores. First: none of these vulnerabilities received a CVE identifier at the time they were fixed. Gardiner's argument is that this obscured the security significance of what was published as a safety-only update. Second: on July 16, 2026, NHTSA's public recall-completion tracker showed completion rates for the associated identifiers ranging from 0 to 99 percent, and NMFTA notes that industry completion typically plateaus near 80 percent.

The standards lens

Four frames should have caught this. Three of them were never opened.

ISO/SAE 21434:2021 Clause 15 — Threat Analysis and Risk Assessment. This is the central miss. Clause 15 is a seven-step pipeline: asset identification (§15.3), threat scenario identification (§15.4), impact rating (§15.5), attack path analysis (§15.6), attack feasibility rating (§15.7), risk value determination (§15.8), risk treatment decision (§15.9). Run against the EC80 with the item boundary drawn honestly, §15.3 has to name the J2497 receive path as an interface, §15.6 has to enumerate RF induction as a documented attack path — CVE-2022-26131 was public two years before the recall — and §15.8 lands on a risk value that forces a treatment decision. There is no evidence any of that happened. The defect was routed as an electromagnetic robustness problem, which is a safety pipeline, and safety pipelines do not have an attacker in them.

ISO/SAE 21434 Clause 8 — Continual cybersecurity activities. Clause 8 exists precisely for this shape of event: §8.2 cybersecurity monitoring, §8.3 cybersecurity event assessment, §8.4 vulnerability analysis, §8.5 vulnerability management. A field defect in which malformed input causes memory corruption in a safety function is a textbook §8.3 trigger. The correct output of §8.3 is a decision — is this weakness a vulnerability? — and §8.4/§8.5 then require it to be analysed and managed, which in practice means a CVE and a coordinated disclosure so that operators can perform their own risk assessment. Gardiner said exactly this: "The recall action is a commendable effort... But the security impact of the changes should be communicated so that fleets can perform their own risk calculations." The absence of a CVE in 2024 is not a paperwork complaint. It is the observable symptom of a Clause 8 pipeline that either does not exist or was never fed.

ISO 26262-3:2018 Clause 7 — HARA, and the safe state that was not one. The 2018 second edition explicitly brought trucks, buses, trailers and semi-trailers into scope, so there is no hiding behind "this is a heavy vehicle." Two things in the record read as HARA findings rather than security findings. First, the hazard is not merely "ABS unavailable" — the road tests show total loss of CAN traffic, taking speedometer, shift and steering assist with it, which is a much wider hazardous event than the recall language suggests. Second, and worse: the fault reaction is a latch that requires disconnecting the battery to clear. ISO 26262 expects an item to transition to a defined safe state within the fault handling time interval. "Stop the truck, open the hood, pull the battery, and in one case go get a dealer tool" is not a safe state. It is an unbounded degraded state entered while moving.

FMVSS 121 and FMVSS 136 — the regulatory floor, and why it is not a security floor. FMVSS 121 S5.1.6 requires ABS on air-braked truck tractors and requires the tractor to display a trailer ABS malfunction indicator in the cab; that in-cab lamp requirement is the entire commercial reason J2497 exists. FMVSS 136 (49 CFR 571.136) requires electronic stability control on truck tractors and large buses. Both are performance standards. They specify stopping distances, lamp behaviour and stability manoeuvres. Neither says one word about what the ECU should do with a message whose declared length exceeds its buffer. And unlike Europe, where UN R155 would put a certified cybersecurity management system behind vehicle type approval — including category O trailers carrying at least one ECU — the United States has no binding vehicle cybersecurity regulation. NHTSA's Cybersecurity Best Practices for the Safety of Modern Vehicles is guidance, not a rule. The heavy-duty in-vehicle security recommended practice, SAE J1939-91C, is likewise voluntary. So the entire regulatory apparatus that forced the recall had nothing in it that would have forced the TARA.

49 CFR Part 573 — and the three-different-causes problem. Part 573.6(c) requires a defect information report containing a description of the defect and a chronology of principal events. Three OEMs filed against one firmware image and produced "incorrect processing of PLC messages / memory overwrite effects," silence, and "inadequate systems validation." Those are not three views of one root cause; two of them are not root causes at all. From a supplier-quality standpoint that is an ISO/SAE 21434 Clause 7 problem — distributed cybersecurity activities, and the Cybersecurity Interface Agreement that is supposed to define who analyses what and who tells whom. The tier-one held the analysis. The OEMs held the filing obligation. The information did not survive the interface.

A worked snippet: the TARA row nobody wrote

Here is the Clause 15 row as it should have existed in 2022, when CVE-2022-26131 published, and certainly by late 2024 when the memory corruption was confirmed in the field.

| Clause 15 step | Content | |---|---| | §15.3 Asset | Availability and integrity of the EC80 brake control function; integrity of the J1939 frames the EC80 sources and gateways (wheel speed, ABS/ATC/ESC status, vehicle speed) | | §15.4 Threat scenario | Tampering / Denial of Service. An attacker-chosen J2497 frame sequence with a declared length exceeding the receive buffer causes a stack write past the bound, crashing the EC80 and halting its CAN transmissions | | §15.5 Impact rating | Safety: Severe — loss of ABS/ESC on a loaded combination vehicle. Operational: Major — recovery requires battery disconnect, in one case a dealer tool. Financial: Moderate. Privacy: Negligible | | §15.6 Attack path | (a) RF induction onto trailer power line per CVE-2022-26131; (b) compromised trailer telematics unit already on the PLC line; (c) direct injection at the diagnostic connector | | §15.7 Attack feasibility | Medium. Elapsed time low (protocol public since 2001), expertise medium, equipment standard SDR, window of opportunity unlimited on a public road | | §15.8 Risk value | 4 of 5 | | §15.9 Treatment | Reduce. Bound every length field at the J2497 decode boundary; add a fault reaction that recovers without battery disconnect; remove all non-lamp functions from J2497 |

And the attack path expanded as a fault tree. Note that the environmental branch and the malicious branch converge on the same two basic events — which is the whole point of this post.

TOP EVENT: Loss of EC80 function on a moving combination vehicle
   |
   +--- OR ------------------------------------------------------+
   |                                                             |
 [A] Environmental cause                            [B] Malicious cause
   |  high electrical noise AND                       |  attacker-chosen J2497
   |  low PLC signal strength                         |  frame sequence
   |  (worse on doubles/triples)                      |
   |                                                  +--- OR ---+
   |                                                  |          |
   |                                       [B1] RF induction     [B2] Compromised
   |                                            on trailer            trailer
   |                                            power line            telematics
   |                                            CVE-2022-26131        unit
   |                                                  |
   |                                       [B3] Injection at the
   |                                            diagnostic connector
   |
   +--- AND (common to both branches) ----------------------------+
        |                                                         |
     [C] J2497 receive path accepts a declared               [D] No fault reaction
         message length it does not bound                        returns the ECU to
         CWE-121 / CWE-787                                       operation without a
                                                                 battery disconnect

The corresponding ISO 26262-3 §7 rows, rated against the behaviour NMFTA actually measured rather than the behaviour the recall described:

| ID | Malfunctioning behaviour | Operating situation | Hazardous event | S | E | C | ASIL | |---|---|---|---|---|---|---|---| | HZ-EC80-01 | Complete loss of EC80 function; CAN transmission halted; state latched until battery disconnect | Loaded tractor plus two trailers, highway speed, wet pavement | ABS and ESC unavailable during a braking or evasive event; speedometer, shift and steering assist simultaneously lost | S3 | E4 | C3 | D | | HZ-EC80-02 | Automatic traction control silently deactivated, no annunciation | Loaded combination, packed snow, launch on grade | Drive-axle wheelspin, loss of directional stability of the combination | S3 | E3 | C3 | C |

HZ-EC80-01 is where the argument lives. The recall framing supports S3/E3/C2 at worst — ABS degrades, the driver still has service brakes. The road-test framing does not. If the speedometer, the transmission shift path and steering assist all drop at once, and the condition cannot be cleared from the cab, the controllability argument that carries the lower rating is gone. Same ECU, same defect, two ratings, and the difference is entirely whether you measured the failure or described it.

Derived requirements (excerpt)

Stable IDs, testable thresholds, traceable to the rows above.

CSR-EC80-001 (from §15.9, HZ-EC80-01, ASIL D / CAL 3). The J2497 receive path shall validate the declared length field of every inbound frame against the allocated receive buffer size before any copy operation, and shall discard any frame whose declared length exceeds the buffer. Rejected-frame count shall be exposed as a diagnostic parameter. Verification: fuzz campaign over the J2497 decode boundary with a minimum of 10^6 mutated frames, zero memory-safety faults, per the verification methods of ISO/SAE 21434 Clause 10.

CSR-EC80-002 (from HZ-EC80-01, fault reaction). On detection of an unrecoverable software exception, the EC80 shall perform a controlled reset and resume J1939 transmission of vehicle speed, ABS status and ESC status within 500 ms, without requiring removal of battery power or an external service tool. No fault state shall be reachable that persists across an ignition cycle without an operator-clearable path. Verification: fault injection on a rolling road, 100 consecutive trials, 100 percent recovery within budget.

CSR-EC80-003 (from HZ-EC80-02, CWE-798). No credential used to enable, disable or reconfigure a braking, traction or stability function shall be identical across production units. Any such credential shall be per-ECU and derived from a device-unique secret provisioned at end of line. Verification: extract and compare credential material from a sample of 20 units across at least 3 build lots; zero collisions.

CSR-EC80-004 (from §15.4, architecture). The EC80 shall accept no command from the J2497 interface that changes the state of a braking, traction or stability function. J2497 inbound handling shall be restricted to trailer ABS lamp status, consistent with the position NMFTA is advocating at SAE Truck and Bus. All other trailer-originated data shall arrive on an authenticated in-vehicle bus. Verification: interface analysis plus negative testing of the full J2497 message set.

CSR-EC80-005 (from §8.3/§8.5, process). Any field defect whose mechanism is malformed, unexpected or out-of-range input to a safety-related function shall be assessed as a cybersecurity event under ISO/SAE 21434 §8.3 before the safety remedy is released, and a CVE shall be requested where the assessment concludes the weakness is exploitable. The security disposition shall be stated in the customer technical bulletin accompanying the remedy. Verification: audit of the last 24 months of field actions against this criterion; 100 percent dispositioned.

What the headline really tells us

The headline says a truck brake controller had three CVEs. The engineering says something narrower and more uncomfortable: an organisation found a memory-safety defect in a safety-critical ECU, fixed it correctly, and never asked who else might send those bytes.

That is not incompetence. It is a routing failure, and it is structural. The defect arrived through a channel that reads as electromagnetic — noise, signal strength, doubles and triples, a competitor's TSB about ABS signal integrity. Every one of those cues points at the EMC and robustness side of the house. The fix was correct on that reading. The recall was fast, and Gardiner said so plainly: it is impressive how quickly the safety-impacting issue was identified and remediated. Nothing about the safety response deserves criticism.

What is missing is a single decision gate: this defect is triggered by input we do not control, so before we close it, someone with an attacker's job title looks at it. ISO/SAE 21434 §8.3 is that gate written down. Without it, the security consequences of the patch stayed invisible for twenty months, no CVE existed to prioritise the reflash, and fleets ran a completion-rate campaign against a safety notice instead of a security one — which matters, because a fleet that plateaus at 80 percent completion on an EMC nuisance is making a different decision than a fleet that plateaus at 80 percent on a remotely reachable brake-ECU RCE.

There is a second, older artifact missing underneath all of it. J2497 was specified in an era when the threat model for a trailer power line was "wire chafe." It carries a federally mandated lamp signal, it is wirelessly writable, it is on a fleet with a 30-year replacement cycle, and until 2024 nobody had demonstrated that anything on it could reach a brake function. Now something has. NMFTA's proposal at SAE Truck and Bus is the right shape — move everything except the trailer ABS fault lamp off J2497, and mitigate on new tractors to protect the legacy trailers you cannot replace. That is not a patch, it is an interface decision, and interface decisions are the only kind of fix that outlives the installed base.

If you own a fleet: check your completion rate on 24E086 and the OEM campaigns behind it, and check it as a security item, not a maintenance item. If you build heavy-vehicle ECUs: go pull your last five field actions and ask which of them were triggered by malformed input. Then ask who looked at them a second time.

— Jherrod Thomas, The Lion of Functional Safety™

Sources